Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chromium devs want the browser to talk to devices, computers directly

theregister.com

Post reply on HN
Print view View original

41–50 of 89 posts

Re: Chromium devs want the browser to talk to devices, computers directly

#41

Post by modeless »

kevingadd wrote: post #39
modeless wrote: post #38

Earlier quoted context omitted.

You could achieve this with HTTPS and Signed Exchanges. https://developers.google.com/web/updates/2018/11/signed-exc...

My understanding is Signed Exchanges only solve "I want to allow another server to handle requests for my HTTPS server" and not "I want to guarantee the integrity of content coming from my HTTPS server". Did they expand the spec to somehow address the latter?

You could obtain an HTTPS certificate and then only use it for offline signing. That would fulfill the same purpose.

Re: Chromium devs want the browser to talk to devices, computers directly

#42

Post by zepto »

nobodyandproud wrote: post #33
nikkwong wrote: post #14

I don't know; I understand the cynicism here.. But can we assume an optimistic scenario where vendors are able to properly address the security implications and this enables web developers to build all kinds of new applications? I for one would love to be able to write web applications that could, say, control the lights in my house or smart devices. I hate interfacing with my phone to control these types of actions;…

The cynicism isn’t fully appreciated, if the optimistic scenario is assumed. Security is hard, and exposing more by default (or making it defacto required) is simply asking for trouble.

It’s funny - in the arguments about Apple and the App Store, I’ve seen plenty of people making the opposite case - ‘it’s not scary out there’, the security benefits of the App Store are ‘bullshit’, etc.

Re: Chromium devs want the browser to talk to devices, computers directly

#43

Post by zepto »

api wrote: post #9

Security concerns here are overblown, and this is IMHO more useful than WebRTC. This is how it should have been done to begin with, as well as the ugly hack known as web sockets. There should be some restrictions. No ports under 1024 without asking the user would go a long way. Anyone saying “the web isn’t an application platform” needs to just accept reality. That ship sailed almost 20 years ago.

Overblown?

Re: Chromium devs want the browser to talk to devices, computers directly

#44

Post by coldtea »

jart wrote: post #40

Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers? Web pages and JavaScript are the only universally trusted medium for sharing information and simple software. Making it possible for news websites to touch ethernet/usb/serial/gpu compromises that. Same goes for optimizations ilke JIT'ing and WebAssembly which have certainly done a great job…

>Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers?

Only in the sense that we can fix child hunger rather than spending money in e.g. condo development.

That is, technically yes, but nobody with real means cares enough to do it, and those without means don't care enough or have enough power to pressure them...

Re: Chromium devs want the browser to talk to devices, computers directly

#45

Post by coldtea »

ffpip wrote: post #15
Animats wrote: post #11

"Note that this capability is already available to Chrome Apps and Extensions and in no scenario will we be handing it out like candy to any website that asks nicely; [the API] will come with a higher barrier to use." Involving Google as a gatekeeper, of course. Google is trying to establish the level of control on the Web it has on Android.

Google just wants browsers to become more powerful cuz then more people will use Chromebooks. since everything can be done on a browser. Why do you think PWA's are being pushed so hard by google? So people can build PWA's that also run on Chromebooks. No need for native apps

Google doesn't care that much about Chromebooks, and certainly not anymore.

They care about people using Google - Chrome, Gmail, Android, etc, but Chromebooks are not some sort of "endgame".

Re: Chromium devs want the browser to talk to devices, computers directly

#46

Post by tasubotadas »

This is good. I guess. I have to develop relatively complex desktop-like applications on Chromium platform and I still feel that there are quite a few gaps until it can become a full desktop-able development platform.

What's really missing for me is Android-like permission system where website could request permissions to access webcam, bluetooth, microphone, local storage, notifications, audio playback etc...

At the moment, most of the access is provided by a number of different APIs, and, in some instances, it is heuristics-based decision (looking at audio playback).

Re: Chromium devs want the browser to talk to devices, computers directly

#47

Post by oakesm9 »

dsun179 wrote: post #18
ffpip wrote: post #15

Earlier quoted context omitted.

Google just wants browsers to become more powerful cuz then more people will use Chromebooks. since everything can be done on a browser. Why do you think PWA's are being pushed so hard by google? So people can build PWA's that also run on Chromebooks. No need for native apps

I think PWA's were pushed because the google cannot crawl native applications for its search engine.

With a few tweaks to a native app, they can https://firebase.google.com/docs/app-indexing

On Android they already crawl your app with various devices when you upload it to Google play and let you know about any crashes or accessibility issues. Nothing to stop them capturing the content too if they wanted.

Re: Chromium devs want the browser to talk to devices, computers directly

#48

Post by giancarlostoro »

jart wrote: post #40

Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers? Web pages and JavaScript are the only universally trusted medium for sharing information and simple software. Making it possible for news websites to touch ethernet/usb/serial/gpu compromises that. Same goes for optimizations ilke JIT'ing and WebAssembly which have certainly done a great job…

I think WASM will eventually produce the solution (hear me out before you tune out). I've been thinking about this for a while. So we have WASI[0], which doesn't yet address the UI issue, but there's half a dozen at least projects attempting to create runtimes for WASM. If most languages wind up compiling for WASM / WASI I think eventually a good effort could be done towards a WASI-UI or WASUI.

Imagine if major OS platforms had a common UI framework that any language can produce a UI for, every major browser already supports WASM, why not a WASI based common runtime that would benefit every OS that supports it. I havent seen anyone else discussing this I've just been contemplating it for a while and I'm not sure what it would look like short of recreating a cross-platform X window system.

However, as crazy as I sound my reason for this is simple: the issue with a lot of UI frameworks is that they tend to be language specific and are mostly useful to the languages they officially or directly support. If you can build a UI compatible stack that any language can target, you can gain a lot more adoption. I could easily see Rust, D, Go, etc supporting a common UI runtime.

Electron sells itself rather easily cause most devs are familiar with HTML / CSS / JS. What we need is a cross-platform cross-language solution that isn't XML based but something a language can implement rather simply, or maybe even a compiler / standard library could manage.

[0]: https://wasi.dev/

Re: Chromium devs want the browser to talk to devices, computers directly

#49

Post by Havoc »

jart wrote: post #40

Could we please just fix native software development, so it doesn't suck, rather than adding the kitchen sink to web browsers? Web pages and JavaScript are the only universally trusted medium for sharing information and simple software. Making it possible for news websites to touch ethernet/usb/serial/gpu compromises that. Same goes for optimizations ilke JIT'ing and WebAssembly which have certainly done a great job…

>rather than adding the kitchen sink to web browsers?

Given Chromebooks etc that seems to be exactly the plan

Re: Chromium devs want the browser to talk to devices, computers directly

#50

Post by nikkwong »

skywhopper wrote: post #37
nikkwong wrote: post #14

I don't know; I understand the cynicism here.. But can we assume an optimistic scenario where vendors are able to properly address the security implications and this enables web developers to build all kinds of new applications? I for one would love to be able to write web applications that could, say, control the lights in my house or smart devices. I hate interfacing with my phone to control these types of actions;…

No, we have decades of evidence (including state of the art tech, right now, today) that argues against your optimistic scenario. In fact, Chrome is basically a piece of spyware as is. Google has no incentive to protect your privacy. How much worse will it get if the browser can reach into your LAN?

Yeah I agree. The browser does seem to be the preeminent attack vector since it's the easiest way for actors to reach into your systems. I can imagine the next generation of ransomware where your smart devices are held hostage for small-ish ransoms.

To your point about privacy, yeah I also agree. I think the real evil here is how implicit the exploitation of trust is with using Chrome and Google services. Ideally the privacy disclaimers should be more pronounced and end users should know what exactly they're giving up by using these products.

I come from the Chinese mindset where privacy doesn't have the capital P like it does in the US. Most Chinese are fine with the government and private industry infiltrating their lives if the net effect is that their lives are improved. I think a lot of them have not fully weighed the cost-benefit analysis properly, and who knows if there ever will be a tipping point event where people decide technology has too deep a hand in their inner-lives.

I think most people in the US have yet to encounter the potentially dire consequences of the slow erosion of their privacy. Who knows, maybe the net effect for most consumers will always be positive. I'm still using Chrome, Gmail, and am locked into Google's net, but I like to think it's something I'm cognizant of, and paying attention to from far away.

Post reply on HN